Download the PHP package narakode/fineauth without Composer

Fine Auth

A simple authentication package for Laravel REST APIs.

Features

• Login
• Access Tokens
• Refresh Tokens
• Current Authenticated User

Requirements

• PHP ^8.3
• Laravel ^13
• Laravel Sanctum ^4.3

Installation

Install the package:

Publish the package configuration:

This package requires Laravel Sanctum. If you haven't installed it yet, run:

Add the HasApiTokens and HasRefreshTokens traits to your User model.

Usage

Register the authentication routes in your routes file (for example, routes/api.php):

You can verify that the routes have been registered by listing your application's routes:

Endpoints

Login

The POST /login endpoint requires the following request parameters:

• email
• password

The package uses Laravel's authentication system to validate the provided credentials.

If the credentials are invalid, it returns a 401 Unauthorized response:

If authentication succeeds, it returns a 200 OK response:

A refresh token is also returned as an HTTP cookie named refresh_token with the following attributes:

• Expires in 1 hour
• HttpOnly
• Secure
• SameSite

Current User

The GET /me endpoint returns the authenticated user associated with the provided access token.

Provide the access token in the Authorization header using the following format:

If the access token is valid, the response will be:

If the access token is missing or invalid, the endpoint returns a 401 Unauthorized response.

Refresh Token

The POST /refresh-token endpoint returns a new access token and the authenticated user using the refresh token stored in a cookie.

If the cookie is exists and has not expired, the response is the same as login. Otherwise, the endpoint returns 401 Unauthorized.

Customization

Custom Credentials

By default, this package uses the email and password fields as the authentication credentials.

You can customize these credentials by creating a class that implements the Narakode\FineAuth\Auth\AuthCredentials interface.

The class should define a rules method that returns an array containing the credential fields and their validation rules.

For example, create App\Auth\AuthCredentials.php.

Then, register the AuthCredentials in your application service provider (App\Providers\AppServiceProvider.php).

Custom Authenticator

By default, this package uses Auth::attempt($credentials) to determine whether the credentials are valid.

You can customize this behavior by creating a class that implements the Narakode\FineAuth\Auth\Authenticator interface.

The class should define an attempt method that accepts a credentials array as its parameter.

The attempt method should return a User object when the credentials are valid, or false when they are invalid.

For example, create App\Auth\Authenticator.php.

Then, register the Authenticator in your application service provider (App\Providers\AppServiceProvider.php).

Adding Meta

You can add a meta object to the response for the login, refresh, and me endpoints by creating a class that implements the Narakode\FineAuth\Auth\AuthMeta interface.

The class should define a toArray method that accepts a Narakode\FineAuth\Auth\AuthContext object as its parameter.

The toArray method should return an array that will be included as the meta field in the JSON response.

The AuthContext object exposes the getUser method, which returns the authenticated User object.

For example, create App\Auth\AuthMeta.php.

Then, register the AuthMeta in your application service provider (App\Providers\AppServiceProvider.php).

Custom Expiration

By default, the access token expires after 15 minutes, and the refresh token expires after 2 months.

To customize these values, edit the config/fineauth.php file. The expiration values are specified in minutes.